Skip to content

T1001.001 Junk Data

Adversaries may add junk data to protocols used for command and control to make detection more difficult.1 By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Item Value
ID T1001.001
Sub-techniques T1001.001, T1001.002, T1001.003
Tactics TA0011
Platforms ESXi, Linux, Windows, macOS
Version 1.1
Created 15 March 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0007 APT28 APT28 added “junk data” to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a “junk length” value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.19
S1246 BeaverTail BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.15
S0574 BendyBear BendyBear has used byte randomization to obscure its behavior.6
S0134 Downdelph Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.4
S0588 GoldMax GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.14
S0632 GrimAgent GrimAgent can pad C2 messages with random generated values.17
S1020 Kevin Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.13
S1047 Mori Mori has obfuscated the FML.dll with 200MB of junk data.5
S0016 P2P ZeuS P2P ZeuS added junk data to outgoing UDP packets to peer implants.3
S0626 P8RAT P8RAT can send randomly-generated data as part of its C2 communication.9
S0435 PLEAD PLEAD samples were found to be highly obfuscated with junk code.1011
S0559 SUNBURST SUNBURST added junk bytes to its C2 over HTTP.1
S0682 TrailBlazer TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.7
S0647 Turian Turian can insert pseudo-random characters into its network encryption setup.16
S1164 UPSTYLE UPSTYLE retrieves a non-existent webpage from the command and control server then parses commands from the resulting error logs to decode commands to the web shell.12
S0022 Uroburos Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.8
S0514 WellMess WellMess can use junk data in the Base64 string for additional obfuscation.18

Mitigations

ID Mitigation Description
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

References

  1. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩↩

  2. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. ↩

  3. SecureWorks. (2012). The Lifecycle of Peer-to-Peer (Gameover) ZeuS. Retrieved August 19, 2015. ↩

  4. ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016. ↩

  5. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022. ↩

  6. Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021. ↩

  7. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  8. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023. ↩

  9. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021. ↩

  10. Cherepanov, A.. (2018, July 9). Certificates stolen from Taiwanese tech‑companies misused in Plead malware campaign. Retrieved May 6, 2020. ↩

  11. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020. ↩

  12. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024. ↩

  13. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  14. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021. ↩

  15. Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025. ↩

  16. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021 ↩

  17. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024. ↩

  18. CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020. ↩

  19. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. ↩